Make proxy decider test DNS independent

[starr-openai]

Why

The managed network proxy decider test is meant to prove that the decider still runs after the session starts in full-access mode and then returns to workspace-write restrictions. On Mike's devbox, the test's example.com request can be classified by ambient DNS as local/private before the decider is consulted, so the same shard becomes flaky even though the proxy behavior is correct.

What changed

• use public IP literal 8.8.8.8 in the proxy request instead of example.com
• keep the assertion focused on the decider path, without depending on ambient DNS resolution

Stack

• PR #22199 Isolate tmp-dependent tests from ambient git
• PR #22201 Use remote fs for turn diff repo root
• PR #22200 Emit unified exec end on startup failure
• PR #22389 Stabilize remote routing e2e tests
• this PR Make proxy decider test DNS independent

Validation

• On dev: bazel test //codex-rs/core:core-unit-tests --test_filter=managed_network_proxy_decider_survives_full_access_start --runs_per_test=10 --test_output=errors passed with 80 shard/run executions.
• Broader full remote validation is being rerun from the new top of stack.